Data processing method and system

Abstract

The invention provides a data processing method and system, and relates to the technical field of data processing, and the data processing method comprises the steps: obtaining a network exception time period of a domain name system (DNS); obtaining domain name query information in the network abnormal time period, and determining a white list domain name based on the domain name query information; reading the TTL (Transistor-Transistor Logic) of the white list domain names from the cache server, and grouping the white list domain names in the cache server according to the TTL to obtain one or more groups corresponding to the white list domain names; and in response to the TTL of the group meeting the updating condition, sending an updating request to the recursive server to obtain the latest address information of the white list domain name in the group, and sending the latest address information to the cache server corresponding to the group to update the address information, the technical problem of link congestion caused by simultaneous iterative query of the same domain name in the prior art is solved, and the utilization rate of the server is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a data processing method and system. BACKGROUND

[0002] The domain name system (DNS) is a distributed database that maps domain names and Internet Protocol (IP) addresses to each other, making it easier for people to access the Internet. It is an important service that carries the Internet, and DNS abnormalities are equivalent to Internet outages for most users.

[0003] In the prior art, a multi-layer architecture and multi-level cache method are used, with cache and recursion deployed separately, business and management deployed separately, and node fault tolerance technology ensuring system security and availability. However, with the rapid growth of Internet applications and traffic, high-frequency resource refresh and scheduling for users are increasingly frequent, and domain name caching between different cache servers requires iterative querying to the recursion server and authoritative server. The link congestion, high server utilization, and increased query delay when the recursion server iteratively queries the authority, and the network construction appears to be a chimney-type expansion, and the system resources are idle at idle times. SUMMARY

[0004] The present application aims to at least partially solve one of the technical problems in the related art.

[0005] To this end, the first object of the present application is to provide a data processing method to solve the problem of network congestion and low efficiency of repeated queries caused by high-frequency domain name recursion requests.

[0006] The second object of the present application is to provide a data processing system.

[0007] The third object of the present application is to provide an electronic device.

[0008] The fourth object of the present application is to provide a computer-readable storage medium.

[0009] The fifth object of the present application is to provide a computer program product.

[0010] To achieve the above objects, the first aspect of the present application provides a data processing method, comprising:

[0011] obtaining a network abnormal time period of a domain name system (DNS);

[0012] obtaining domain name query information in the network abnormal time period, and determining a white list domain name based on the domain name query information;

[0013] read a time to live TTL of the white list domain name from the cache server, and group the white list domain name in the cache server according to the TTL, to obtain one or more groups corresponding to the white list domain name;

[0014] In response to the TTL of the group meeting an update condition, send an update request to the recursive server to obtain the latest address information of the white list domain name in the group, and send the latest address information to the cache server corresponding to the group for address information update.

[0015] To achieve the above purpose, a second aspect embodiment of the present application proposes a data processing system, comprising:

[0016] a cache server, a data processing device, a recursive server and a DNS server;

[0017] The cache server is configured to store a time to live TTL of a domain name and address information corresponding to the domain name.

[0018] The data processing device is configured to obtain a network exception time period of the DNS server, obtain domain name query information in the network exception time period, determine a white list domain name based on the domain name query information, read a TTL of the white list domain name from the cache server, and group the white list domain name in the cache server according to the TTL, to obtain one or more groups corresponding to each white list domain name. When the TTL of the group meets an update condition, an update request is sent to the recursive server.

[0019] The recursive server is configured to receive the update request and send the latest address information of the white list domain name in the group to the data processing device.

[0020] The data processing device is further configured to send the latest address information to the cache server corresponding to the group for address information update.

[0021] To achieve the above purpose, a third aspect embodiment of the present application proposes an electronic device, comprising a processor and a memory connected in communication with the processor.

[0022] The memory stores computer execution instructions.

[0023] The processor executes the computer execution instructions stored in the memory to implement the method of the first aspect embodiment.

[0024] To achieve the above object, the fourth aspect of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the method in the first aspect of the present application.

[0025] To achieve the above object, the fifth aspect of the present application provides a computer program product, wherein the computer program is executed by a processor to implement the method in the first aspect of the present application.

[0026] The data processing method and system provided by the present application can obtain the network abnormal time period of DNS, filter out the white list domain name in the network abnormal time period, provide processing efficiency while reducing resource consumption, read the TTL of each white list domain name from the cache server, divide each white list domain name into one or more groups according to the TTL, further determine whether to update the address information of the white list domain name in time according to whether the TTL in the group meets the update condition, multicast the latest address information to the corresponding cache server to ensure that the cache server can update the white list domain name with expired TTL value at the same time, ensure that the address information of the domain name in the cache server is the latest and effective, avoid the link congestion problem caused by the same domain name iterative query at the same time, and improve the utilization rate of the server.

[0027] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0028] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0029] Figure 1 The existing query flowchart provided by the embodiments of the present application;

[0030] Figure 2 The flowchart of the data processing method provided by the embodiments of the present application;

[0031] Figure 3 The flowchart of another data processing method provided by the embodiments of the present application;

[0032] Figure 4 The flowchart of another data processing method provided by the embodiments of the present application;

[0033] Figure 5 The flowchart of another data processing method provided by the embodiments of the present application;

[0034] Figure 6A logic diagram of a data processing method provided by an embodiment of the present application;

[0035] Figure 7 A structure block diagram of a data processing system provided by an embodiment of the present application. DETAILED DESCRIPTION

[0036] Embodiments of the present application are described in detail below with reference to the accompanying drawings, in which the same or similar elements or elements having the same or similar functions are denoted by the same or similar reference numerals throughout. The embodiments described below by reference to the accompanying drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0037] Currently, when querying by using a multi-layer architecture and a multi-level cache mode of a cache server, a recursive server and an authoritative server, there are three cases of answering query results: 1. When the cache server has corresponding cache content, the cache server directly answers the cache; 2. When the cache server does not have corresponding cache content or reaches a penetration condition, penetration is performed; 3. When the cache server has corresponding cache content, the update condition is reached, and the penetration condition is not reached, and update is performed; that is, when a user queries DNS domain name resolution, the cache server is first accessed, the cache server is responsible for receiving a request sent by a user end, querying a query result required by the user and returning the resolver of the user end; when the cache does not exist a domain name record requested by the user, a resolution request is sent to the recursive server to perform iterative query, wherein penetration, update and the like need to be transmitted to the recursive server by the cache server, and iterative query is performed by the recursive server to the authoritative server, and a specific process is as shown in Figure 1 .

[0038] With the current surge of Internet applications and traffic, based on multi-level load balancing cache, the cache servers form a cluster relationship, at a specific time point such as a late peak period, when the domain name survival time in different cache servers in the cluster expires, because each device is an independent physical device and is independently deployed, it cannot be associated, shared and synchronized to other caches, and the same domain name recursive query needs to be repeated, the hierarchical cache recursive server will query a high-frequency update action, that is, the domain name cache between different cache servers needs to be iteratively queried to the recursive server and the authoritative server, and link congestion, high server utilization and increased query delay may occur in the iterative query process of the recursive server to the authoritative server, and the query efficiency is low.

[0039] The data processing method and system of the embodiments of the present application are described below with reference to the accompanying drawings.

[0040] Figure 2 A flowchart of a data processing method provided by an embodiment of the present application is shown in Figure 2 , and the data processing method includes the following steps:

[0041] S201, acquire a network anomaly time period of a domain name system (DNS).

[0042] In some implementations, the network anomaly time period refers to a time period when the DNS is frequently accessed or requested, at which time the DNS server is under great pressure or has a large query delay, and it is difficult to support efficient requests. Alternatively, the DNS server pressure, iterative query link peak utilization, and query delay can be acquired to determine whether the network access pressure is too large, for example, when the DNS server pressure exceeds a threshold value or the query delay exceeds a threshold value, it is determined that the network access pressure is large, that is, the network is abnormal, and the start time and end time of the network anomaly are recorded as the network anomaly time period.

[0043] S202, acquire domain name query information in the network anomaly time period, and determine a white list domain name based on the domain name query information.

[0044] Alternatively, the domain name query information includes all domain name records that request an iterative query of a recursive server in the network anomaly time period, and the domain name records in the domain name query information can be filtered to determine the white list domain name in the domain name query information.

[0045] In some implementations, the white list domain name in this embodiment refers to a high-frequency access domain name list in the anomaly period. The high-frequency access domain name list may request an iterative query of a recursive server from multiple cache servers when penetration or update is required, and therefore the high-frequency access domain name is filtered as a white list domain name.

[0046] Alternatively, the request query times of each domain name can be determined according to the domain name query information. The more the request query times, the higher the access request frequency of the domain name, and therefore the domain names can be sorted according to the request query times, and the top 80% of the sorted domain names are selected as the white list domain name. In other embodiments, the white list domain name can be filtered according to actual requirements, and details are not described.

[0047] S203, read the time to live (TTL) of the white list domain name from the cache server, and group the white list domain name in the cache server according to the TTL to obtain one or more groups corresponding to the white list domain name.

[0048] It can be understood that the time to live (TTL) refers to the survival time of a domain name resolution record in a DNS cache, that is, the effective time length of the DNS record in the cache server. When a user's query request is sent to the cache server, if the cache server caches the relevant record of the query request and the corresponding TTL has not expired, the cache server will directly use the cached record information to respond to the query request, without the need to query other servers, thereby reducing network delay.

[0049] read the TTL of each white list domain name from the cache server, one or more white list domain names exist in a cache server, the same white list domain name exists in one or more cache servers, and the TTL corresponding to the white list domain name can be the same or different.

[0050] It can be understood that when the TTL of the white list domain name approaches 0, it indicates that the domain name information of the white list domain name in the current cache server will expire. In this embodiment, the same white list domain name is grouped according to the TTL, and one or more groups corresponding to the white list domain name are obtained.

[0051] For example, assuming that the white list domain name A exists in five cache servers in the cache server cluster, and the TTLs in the five cache servers are 101, 60, 3, 55 and 128 respectively, if a group is divided every 5 seconds, the TTLs of the domain name A in the five cache servers are divided to obtain four groups

[101] , [60, 55], [3] and

[128] , and each group can include the cache server identifier to which the TTL belongs, for example, the five cache server identifiers are h1, h3, h4, h6 and h8, and the divided groups can also be represented as [(101, h1)], [(60, h3), (55, h6)], [(3, h4)] and [(128, h8)].

[0052] S204, in response to the TTL of the group meeting the update condition, sending an update request to the recursive server to obtain the latest address information of the white list domain name in the group, and sending the latest address information to the cache server corresponding to the group to update the address information.

[0053] In some implementations, the update condition is used to determine whether the TTL of the current group is about to expire, and the judgment condition for updating the address resolution information. When the TTL of the group is about to expire and meets the update condition, an update request is sent to the recursive server, and the update request is used to instruct the recursive server to perform iterative query to the authoritative server to obtain the latest address information of the white list domain name.

[0054] It can be understood that for one or more groups divided by a white list domain name, the TTL values of the white list domain name in the group include the TTL values of the white list domain name in one or more cache servers, and the TTL values in each group are relatively small. The TTL value of the group can be judged based on the minimum TTL value in the group, that is, when the minimum TTL value in the group meets the update condition, an update request is sent to the recursive server.

[0055] Optionally, the update condition can be that the TTL value is less than or equal to 3 seconds, and when the minimum TTL value in the group is less than or equal to 3 seconds, an update request for the whitelist domain name is sent to the recursive server, the recursive server iteratively queries to obtain the latest address information of the whitelist domain name, and the latest address information is sent to the corresponding cache server according to the cache server identifier in the group to update the address, so as to ensure that the latest address information of the domain name can be obtained from the cache server when the user performs domain name query, avoid link congestion caused by simultaneous iterative query of the same domain name, and improve server utilization.

[0056] In the embodiment, the network abnormal time period of DNS is obtained, and the whitelist domain name with high frequency request is screened out in the network abnormal time period. The high frequency domain name is updated and analyzed, the processing efficiency is provided, and the resource consumption is reduced. Further, the TTL of each whitelist domain name is read from the cache server, TTLs close to each other of each whitelist domain name are grouped according to TTL, one or more groups corresponding to the whitelist domain name are obtained, whether the TTL in the group meets the update condition is determined to determine whether the address information of the whitelist domain name is updated in time, and the latest address information is multicast to the corresponding cache server, so as to ensure that the cache server can update the whitelist domain name with TTL value expired at the same time, ensure that the address information of the domain name in the cache server is the latest and effective, avoid link congestion caused by simultaneous iterative query of the same domain name, and improve server utilization.

[0057] On the basis of the above embodiment, Figure 3 Another flowchart of a data processing method provided by the embodiment of the application is shown in FIG. 6. Figure 3 As shown in the figure, the data processing method comprises the following steps:

[0058] S301, a network abnormal time period of a domain name system (DNS) is obtained.

[0059] Optionally, network test data can be sent to the DNS to obtain network environment information fed back by the DNS. The DNS pressure, link peak utilization rate and query delay are determined according to the network environment information. It can be understood that the network test data is used to detect the network state of the DNS, and the network environment information fed back by the DNS includes at least the DNS pressure, link peak utilization rate and query delay. The DNS pressure is used to reflect the load condition of the corresponding server. The link peak utilization rate refers to the maximum utilization rate of the DNS query link. The query delay refers to the time from sending a DNS query request to receiving a corresponding response.

[0060] In response to any abnormality in DNS pressure, peak link utilization, or query latency, a network anomaly is identified; the start and end times of the network anomaly are determined, and the time period of the network anomaly is determined based on the start and end times.

[0061] Optionally, thresholds can be used to determine whether indicators such as server pressure, peak link utilization, and query latency are abnormal. In this embodiment, the abnormality of indicators is determined by whether the server pressure is greater than 90%, the peak link utilization is greater than 80%, and the query latency is more than 300% higher than the average of the same period of the previous day. That is, when the server pressure is greater than 90%, the peak link utilization is greater than 80%, or the query latency is more than 300% higher than the average of the same period of the previous day, the network is determined to be abnormal, and the network abnormality period is determined according to the start and end time of the network abnormality.

[0062] In this application embodiment, the implementation method of step S301 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0063] S302, Obtain domain name query information during the period of network anomaly, and determine the number of query requests and TTL value of the domain name based on the domain name query information.

[0064] Optionally, the request recursive server can be determined based on DNS log resolution records to iteratively query all domain name records, thereby obtaining domain name query information within the network anomaly period. This domain name query information may include, but is not limited to, the request source address, request time, request domain name, domain name's TTL, A / AAAA records, and response time. Here, the request source address refers to the IP address of the device that initiated the domain name query request, the request time refers to the specific time when the domain name query request was initiated, the request domain name is the domain name that the user wants to resolve, the A record is a DNS record that maps the domain name to an IPv4 address, the AAAA record is a DNS record that maps the domain name to an IPv6 address, and the response time is the time when the DNS server responds to the query request.

[0065] In some implementations, the number of query requests and TTL value of a domain name can be determined based on the domain name query information. The number of domain name queries is the number of times the domain name has been requested.

[0066] S303: Determine the total number of query requests for all domains based on the number of query requests for each domain, and determine the query percentage of each domain based on the number of query requests for each domain and the total number of query requests.

[0067] Understandably, the total number of query requests for all domains can be obtained by summing the number of query requests for all domains. The query percentage of a domain can be determined by the ratio of the number of query requests for each domain to the total number of query requests for that domain. The higher the query percentage, the more frequently the domain is queried, and the more likely it is to cause link query congestion.

[0068] S304 indicates that the domain name is whitelisted because the percentage of queries for the domain name is greater than or equal to the preset percentage and the TTL value is less than the preset duration.

[0069] Optionally, the preset percentage can be 80%, and the preset duration can be a penetration time threshold, such as 300 seconds; then domains with a query percentage greater than or equal to 80% and a TTL value less than 300 seconds are selected as whitelist domains.

[0070] In some implementations, a whitelist of domain names can be formed based on all whitelisted domain names, and the query count of each whitelisted domain name in the whitelist can be monitored periodically. That is, all whitelisted domain names are integrated to obtain a whitelist of domain names. The whitelist of domain names includes, but is not limited to, the request source address, request time, request domain name, domain name's TTL, A / AAAA record, and response time. The query count of each whitelisted domain name in the whitelist of domain names is monitored to maintain the whitelist of domain names.

[0071] In response to the fact that the number of queries for any whitelisted domain in the whitelisted domain list is the minimum number of queries for N consecutive days, the whitelisted domain with the minimum number of queries is deleted from the whitelisted domain list, where N is a positive integer. For example, if N is 7, then when any whitelisted domain has the minimum number of queries for 7 consecutive days, the whitelisted domain is deleted from the whitelisted domain list to adapt to the constantly changing high-frequency requests of Internet services.

[0072] S305: Read the Time-to-Live (TTL) of the whitelisted domains from the cache server, and group the whitelisted domains in the cache server according to the TTL to obtain one or more groups corresponding to the whitelisted domains.

[0073] In this application embodiment, the implementation method of step S305 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0074] S306, in response to the group's TTL meeting the update condition, sends an update request to the recursive server to obtain the latest address information of the whitelisted domains within the group, and sends the latest address information to the corresponding cache server of the group to update the address information.

[0075] In this application embodiment, the implementation method of step S306 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0076] In this embodiment, network environment information can be determined based on network test data. Based on DNS pressure, peak link utilization, and query latency within the network environment information, it can be determined whether abnormal conditions are met, thereby identifying network anomaly periods with high access pressure. Targeted analysis of these network anomaly periods is then performed to obtain domain name query information. Based on this information, the number of query requests and TTL value for each domain name are determined, and the query percentage of each domain name is used to filter high-frequency access domains, resulting in a whitelist of domain names. This allows for more precise analysis of the high-frequency whitelist of domain names. Furthermore, the query frequency of the whitelisted domains can be monitored for timely maintenance, adapting to the constantly changing frequency of internet requests and improving analysis accuracy and efficiency. The TTL of the whitelisted domains in the cache server cluster is monitored, and the whitelisted domains are grouped. When the TTL of a group meets the update conditions, the latest address information is obtained and the corresponding cache server is updated, ensuring that the address information of the domain names in the cache server is up-to-date and valid, thus improving server utilization.

[0077] Based on the above embodiments, Figure 4 This is a flowchart illustrating another data processing method provided in an embodiment of this application. Figure 4 As shown, the data processing method includes the following steps:

[0078] S401, obtain the network abnormality period of the Domain Name System (DNS).

[0079] In this application embodiment, the implementation method of step S401 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0080] S402: Obtain domain name query information during the period of network anomaly, and determine whitelisted domain names based on the domain name query information.

[0081] In this application embodiment, the implementation method of step S402 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0082] S403: Read the Time-to-Live (TTL) of the whitelisted domains from the cache server, and group the whitelisted domains in the cache server according to the TTL to obtain one or more groups corresponding to the whitelisted domains.

[0083] In some implementations, the maximum and minimum TTL corresponding to the whitelisted domains can be obtained to determine the TTL range of the whitelisted domains; that is, for any whitelisted domain, the maximum and minimum TTL of the whitelisted domain in the cache server cluster are determined, and the range between the minimum and maximum TTL is used as the TTL range.

[0084] Furthermore, the TTL range is divided into at least two TTL time periods. In this embodiment, the TTL range is divided into arithmetic groups with an interval of 5 seconds. That is, the TTL range is divided into groups of 5 seconds each, and so on, until all the TTL time periods. For example, if the TTL range is [3,121], then the TTL time periods are [3,8], [8,13], [13,18], ..., [113,118] and [118,121].

[0085] Obtain the domain information for each whitelisted domain, including at least the identifier of the cache server to which the whitelisted domain belongs; for the same whitelisted domain, determine the TTL period to which the whitelisted domain belongs based on the TTL value of the whitelisted domain in the cache server to which it belongs; write the whitelisted domains and their domain information belonging to the same TTL period into the same group to obtain one or more groups.

[0086] For example, for whitelisted domain A, its cache servers are Server 1, Server 3, Server 5, and Server 6, and its TTL values ​​in the corresponding cache servers are 3, 5, 114, and 120, respectively. Therefore, the TTL periods for the whitelisted domains are determined to be [3,8], [113,118], and [118,121], respectively. The resulting groups can be represented as {domain A, Server 1, Server 3, [3,8]}, {domain A, Server 5, [113,118]}, and {domain A, Server 6, [118,121]}. In some implementations, domain information such as the request source address, request time, domain TTL, A / AAAA records, and response time can also be written into the group; the specific implementation is not limited.

[0087] In some implementations, the maximum update time of DNS can also be obtained; using the maximum update time as the TTL limit value, the TTL value of the whitelisted domains in the cache server is corrected to obtain the update TTL value of the whitelisted domains; optionally, the target whitelisted domains in the cache server with TTL values ​​greater than the TTL limit value can be determined; the TTL limit value is used as the update TTL value of the target whitelisted domains; for example, in this embodiment, 60 seconds is used as the maximum update time of DNS, that is, the TTL limit value. In other embodiments, the maximum update time can be modified according to the actual limitation situation, which will not be elaborated on in detail; when the TTL of a domain in the cache server is greater than the TTL limit value of 60 seconds, the TTL of the corresponding domain is adjusted to 60 seconds and aging timer is started. For domains with TTL less than the TTL limit value of 60 seconds, their TTL remains unchanged and aging timer is started.

[0088] The whitelisted domains in the cache server are grouped based on the updated TTL value, resulting in one or more groups corresponding to each whitelisted domain. In other words, when grouping whitelisted domains, the maximum TTL value corresponding to the whitelisted domain does not exceed 60 seconds. Grouping is performed based on the maximum TTL and the minimum TTL to obtain one or more groups.

[0089] S404, obtain the minimum TTL of the whitelisted domains in the group, and in response to the minimum TTL being less than or equal to the preset TTL threshold, determine that the group's TTL meets the update conditions.

[0090] Optionally, in this embodiment, the preset TTL threshold can be 3 seconds. That is, when the minimum TTL of the whitelisted domains in the group is less than or equal to 3 seconds, it is determined that the TTL of the group meets the update condition. The update condition is used to indicate that the address information of the whitelisted domains should be updated.

[0091] S405 sends an update request to the recursive server to obtain the latest address information of the whitelisted domains in the group, and sends the latest address information to the corresponding cache server of the group to update the address information.

[0092] Understandably, a recursive server can iteratively query the authoritative server to obtain the latest address information based on update requests. Optionally, it can send the latest address information to the target cache server identified by the cache server identifier corresponding to the whitelisted domains within the group. This latest address information is used to update the address information of the whitelisted domains in the target cache server. In other words, based on the cache server identifier corresponding to the whitelisted domains within the group, the target cache server to which the latest address information should be sent is determined, and the latest address information is multicast to the corresponding target cache server, thereby updating the address of the target cache server and ensuring that the address information in the cache server is up-to-date and valid.

[0093] In this embodiment, after determining the DNS network anomaly time period, the domain name query information within the network anomaly time period is determined, and whitelisted domain names are identified. The Time-to-Live (TTL) of the whitelisted domain names is read from the cache server, and the whitelisted domain names in the cache server are grouped according to the TTL. Alternatively, the TTL of the domain names can be corrected based on the actual TTL limit value, and the grouping is based on the corrected TTL, which is more adaptable. Whitelisted domain names with similar TTLs are divided into groups, and the minimum TTL within the group is used to determine whether the update condition is met. An update request is sent to the recursive server to obtain the latest address information of the whitelisted domain names. The latest address information is multicast to the corresponding target cache server, thereby updating the address of the target cache server and ensuring that the address information in the cache server is up-to-date and valid.

[0094] Based on the above embodiments, Figure 5 This is a flowchart illustrating another data processing method provided in an embodiment of this application. Figure 5 As shown, the data processing method includes the following steps:

[0095] S501, obtain the network abnormality period of the Domain Name System (DNS).

[0096] In this application embodiment, the implementation method of step S501 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0097] S502: Obtain domain name query information during the period of network anomaly, and determine the number of query requests and TTL value of the domain name based on the domain name query information.

[0098] In this application embodiment, the implementation method of step S502 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0099] S503 determines the total number of query requests for all domains based on the number of query requests for each domain, and determines the query percentage of each domain based on the number of query requests for each domain and the total number of query requests.

[0100] In this application embodiment, the implementation method of step S503 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0101] S504 indicates that the domain name is whitelisted because the percentage of domain name queries is greater than or equal to the preset percentage and the TTL value is less than the preset duration.

[0102] In this application embodiment, the implementation method of step S504 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0103] S505 reads the Time-to-Live (TTL) of whitelisted domains from the cache server and groups the whitelisted domains in the cache server according to the TTL to obtain one or more groups corresponding to the whitelisted domains.

[0104] In this application embodiment, the implementation method of step S505 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0105] S506, obtain the minimum TTL of the whitelisted domains in the group, and in response to the minimum TTL being less than or equal to the preset TTL threshold, determine that the group's TTL meets the update conditions.

[0106] In this application embodiment, the implementation method of step S506 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0107] S507 sends an update request to the recursive server to obtain the latest address information of the whitelisted domains within the group, and sends the latest address information to the corresponding cache server of the group to update the address information.

[0108] In this application embodiment, the implementation method of step S507 can be implemented in any of the various embodiments of this disclosure, and no limitation is made here, nor will it be described in detail.

[0109] In this embodiment, network environment information can be determined based on network test data. Based on DNS pressure, peak link utilization, and query latency within the network environment information, it can be determined whether abnormal conditions are met, thereby identifying network anomaly periods with high access pressure. Targeted analysis of these anomaly periods is then performed to obtain domain name query information. Based on this information, the number of query requests and TTL value for each domain name are determined, resulting in a query percentage for each domain. High-frequency access domains are then filtered to obtain a whitelist of domains. This allows for more precise analysis of the whitelist of domains and monitoring of their query counts, enabling timely adjustments to the whitelist. The system performs maintenance; it further reads the Time-to-Live (TTL) of whitelisted domains from the cache server and groups the whitelisted domains in the cache server according to the TTL. It can also modify the TTL of the domains based on the actual TTL limit value and group them according to the modified TTL, which is more adaptable. It divides whitelisted domains with similar TTLs into a group and determines whether the update condition is met based on the minimum TTL in the group. It then sends an update request to the recursive server to obtain the latest address information of the whitelisted domains, ensuring that the address information of the domains in the cache server is up-to-date and valid. This avoids the link congestion problem caused by simultaneous iterative queries of the same domain and improves server utilization.

[0110] Figure 6 This is a logical diagram illustrating a data processing method provided in an embodiment of this application. By probing the network environment information of the DNS, the method determines whether there are any anomalies in the network environment. When a network anomaly occurs, it identifies the time period of the anomaly and obtains domain name query information within that time period. Based on the domain name query information, it determines whether the domain name is a high-frequency domain and whether its TTL is less than 300 seconds. Furthermore, it maintains and updates the whitelist domain name based on whether it represents the minimum number of consecutive N query requests. It further obtains the TTL values ​​of the whitelist domain names in different cache servers and determines whether the TTL values ​​are greater than the TTL limit. For domain names with TTL values ​​greater than the TTL limit, the TTL is corrected and updated to the TTL limit. The method obtains the maximum and minimum TTL of the same whitelist domain name and groups them sequentially according to an arithmetic progression. It determines whether the minimum TTL within each group is less than or equal to 3 seconds. If it is less than or equal to 3 seconds, an update request is sent to the recursive server to obtain the latest address information. This latest address information is then multicast to the cache servers of the whitelist domain names within the group, ensuring that the address information of the domain names in the cache servers is up-to-date and valid. This avoids link congestion caused by simultaneous iterative queries of the same domain name and improves server utilization.

[0111] Figure 7 This is a structural block diagram of a data processing system provided in an embodiment of this application; as shown below. Figure 7 As shown, the data processing system includes:

[0112] Cache server 701, data processing device 702, recursive server 703 and DNS server 704;

[0113] Cache server 701 is used to store the Time-to-Live (TTL) of a domain name and the address information corresponding to the domain name;

[0114] The data processing device 702 is used to obtain the network abnormal time period of the DNS server 704, obtain the domain name query information within the network abnormal time period, determine the whitelist domain names based on the domain name query information, read the TTL of the whitelist domain names from the cache server 701, and group the whitelist domain names in the cache server 701 according to the TTL to obtain one or more groups corresponding to each whitelist domain name. When the TTL of the group meets the update condition, an update request is sent to the recursive server 703.

[0115] The recursive server 703 is used to receive update requests and send the latest address information of the whitelisted domain names in the group to the data processing device 702.

[0116] The data processing device 702 is also used to send the latest parsed information to the cache server 701 corresponding to the group for address information update.

[0117] In some implementations, the data processing device 702 is deployed between the cache server 701 and the recursive server 703 to facilitate interaction with the cache server 701 and the recursive server 703, obtain the latest address information, and multicast it to the cache server 701.

[0118] In some implementations, the data processing device 702 may include a detection unit for sending network test data to the DNS server 704 to obtain network environment information fed back by the DNS server 704; determining DNS pressure, peak link utilization, and query latency based on the network environment information; determining a network anomaly in response to any anomaly among DNS pressure, peak link utilization, and query latency; determining the start and end times of the network anomaly, and determining the network anomaly period based on the start and end times.

[0119] In some implementations, the data processing device 702 may further include a collection unit that can interface with DNS log resolution records via a File Transfer Protocol (FTP) interface to determine the number of query requests and TTL value of a domain name based on domain name query information; determine the total number of query requests for all domain names based on the number of query requests for the domain name, and determine the query percentage of the domain name based on the number of query requests for the domain name and the total number of query requests for the domain name; and determine the domain name as a whitelisted domain name if the query percentage of the domain name is greater than or equal to a preset percentage and the TTL value is less than a preset duration.

[0120] In some implementations, the data processing apparatus 702 may further include a maintenance unit for forming a whitelist of domain names based on all whitelisted domain names and periodically monitoring the number of queries for each whitelisted domain name in the whitelist of domain names; in response to any whitelisted domain name in the whitelist of domain names having the minimum number of queries for N consecutive times, deleting the whitelisted domain name with the minimum number of queries from the whitelist of domain names, where N is a positive integer.

[0121] In some implementations, the data processing device 702 may further include a computing unit, which is used to obtain the maximum TTL and minimum TTL corresponding to the whitelisted domain names to determine the TTL range interval corresponding to the whitelisted domain names; divide the TTL range interval into at least two TTL time periods; obtain the domain name information of each whitelisted domain name, the domain name information including at least the identifier of the cache server to which the whitelisted domain name belongs; for the same whitelisted domain name, determine the TTL time period to which the whitelisted domain name belongs based on the TTL value of the whitelisted domain name in the cache server to which it belongs; and write the whitelisted domain names and their domain name information belonging to the same TTL time period into the same group to obtain one or more groups.

[0122] In some implementations, the data processing device 702 may further include a judgment unit, which is used to obtain the minimum TTL of the whitelisted domains in the group, and determine that the TTL of the group meets the update condition in response to the minimum TTL being less than or equal to a preset TTL threshold.

[0123] In some implementations, the data processing apparatus 702 may further include a multicast delivery unit, which is used to send the latest address information to the target cache server identified by the cache server identifier according to the cache server identifier corresponding to the whitelist domain name in the group. The latest address information is used to update the address information of the whitelist domain name in the target cache server.

[0124] In some implementations, the data processing apparatus 702 further includes an update unit, which is used to obtain the maximum update time of the DNS server 704; use the maximum update time as the TTL limit value to correct the TTL value of the whitelisted domains in the cache server 701 to obtain the updated TTL value of the whitelisted domains; and group the whitelisted domains in the cache server 701 based on the updated TTL value to obtain one or more groups corresponding to each whitelisted domain.

[0125] In some implementations, the update unit of the data processing device 702 is also used to determine the target whitelist domains in the cache server whose TTL values ​​are greater than the TTL limit value; and to use the TTL limit value as the update TTL value of the target whitelist domains.

[0126] In this embodiment, network environment information can be determined based on network test data. Based on DNS pressure, peak link utilization, and query latency within the network environment information, it can be determined whether abnormal conditions are met, thereby identifying network anomaly periods with high access pressure. Targeted analysis of these anomaly periods is then performed to obtain domain name query information. Based on this information, the number of query requests and TTL value for each domain name are determined, resulting in a query percentage for each domain. High-frequency access domains are then filtered to obtain a whitelist of domains. This allows for more precise analysis of the whitelist of domains and monitoring of their query counts, enabling timely adjustments to the whitelist. The system performs maintenance; it further reads the Time-to-Live (TTL) of whitelisted domains from the cache server and groups the whitelisted domains in the cache server according to the TTL. It can also modify the TTL of the domains based on the actual TTL limit value and group them according to the modified TTL, which is more adaptable. It divides whitelisted domains with similar TTLs into a group and determines whether the update condition is met based on the minimum TTL in the group. It then sends an update request to the recursive server to obtain the latest address information of the whitelisted domains, ensuring that the address information of the domains in the cache server is up-to-date and valid. This avoids the link congestion problem caused by simultaneous iterative queries of the same domain and improves server utilization.

[0127] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0128] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0129] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0130] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0131] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0132] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0133] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0134] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0135] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0136] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0137] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0138] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.

[0139] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0140] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A data processing method, characterized in that, The method includes: Obtain the time period of network anomalies in the Domain Name System (DNS); Obtain domain name query information during the network anomaly period, and determine whitelisted domain names based on the domain name query information; Read the Time-to-Live (TTL) of the whitelisted domains from the cache server, and group the whitelisted domains in the cache server according to the TTL to obtain one or more groups corresponding to the whitelisted domains; In response to the TTL of the group meeting the update condition, an update request is sent to the recursive server to obtain the latest address information of the whitelisted domains within the group, and the latest address information is sent to the cache server corresponding to the group for address information update.

2. The method according to claim 1, characterized in that, The network anomaly time period for obtaining the Domain Name System (DNS) includes: Send network test data to the DNS to obtain network environment information from the DNS. Based on the network environment information, determine DNS pressure, peak link utilization, and query latency; If any of the following indicators—DNS pressure, peak link utilization, and query latency—is found to be abnormal, a network anomaly is determined. Determine the start and end times of the network anomaly, and determine the time period of the network anomaly based on the start and end times.

3. The method according to claim 1, characterized in that, The process of determining whitelisted domains based on the domain query information includes: The number of query requests and the TTL value of the domain name are determined based on the domain name query information; The total number of query requests for all domains is determined based on the number of query requests for each domain, and the query percentage of each domain is determined based on the number of query requests for each domain and the total number of query requests. If the query percentage of the domain name is greater than or equal to a preset percentage and the TTL value is less than a preset duration, the domain name is determined to be a whitelisted domain name.

4. The method according to claim 3, characterized in that, The method further includes: A whitelist of domain names is formed based on all the whitelisted domain names, and the number of queries for each whitelisted domain name in the whitelist of domain names is monitored periodically; If the number of queries for any whitelisted domain in the whitelisted domain list is the minimum number of queries for N consecutive times, the whitelisted domain with the minimum number of queries is deleted from the whitelisted domain list, where N is a positive integer.

5. The method according to any one of claims 1-4, characterized in that, The step of grouping whitelisted domains in the cache server according to the TTL to obtain one or more groups corresponding to the whitelisted domains includes: Obtain the maximum TTL and minimum TTL corresponding to the whitelisted domain names to determine the TTL range of the whitelisted domain names; Divide the TTL range into at least two TTL time periods; Obtain the domain information for each of the whitelisted domains, wherein the domain information includes at least the identifier of the cache server to which the whitelisted domain belongs; For the same whitelisted domain name, the TTL period to which the whitelisted domain name belongs is determined based on the TTL value of the whitelisted domain name in its respective cache server; The whitelisted domains and their domain information belonging to the same TTL period are written into the same group to obtain one or more groups.

6. The method according to claim 5, characterized in that, The method for determining whether the TTL of the group satisfies the update condition includes: Obtain the minimum TTL of the whitelisted domains within the group. If the minimum TTL is less than or equal to a preset TTL threshold, determine that the TTL of the group meets the update condition.

7. The method according to claim 6, characterized in that, The step of sending the latest address information to the cache server corresponding to the group for address information update includes: Based on the cache server identifier corresponding to the whitelist domain name within the group, the latest address information is sent to the target cache server identified by the cache server identifier. The latest address information is used to update the address information of the whitelist domain name in the target cache server.

8. The method according to claim 1, characterized in that, The method further includes: Obtain the maximum update time of the DNS; Using the maximum update time as the TTL limit value, the TTL value of the whitelisted domain name in the cache server is corrected to obtain the update TTL value of the whitelisted domain name; Based on the updated TTL value, the whitelisted domains in the cache server are grouped to obtain one or more groups corresponding to each whitelisted domain.

9. The method according to claim 8, characterized in that, The step of using the maximum update time as the TTL limit value to correct the TTL value of the whitelisted domains in the cache server, and obtaining the update TTL value of the whitelisted domains, includes: Identify the target whitelist domains in the cache server whose TTL values ​​are greater than the TTL limit value; The TTL limit value is used as the updated TTL value for the target whitelist domain.

10. A data processing system, characterized in that, include: Cache servers, data processing devices, recursive servers, and DNS servers; The cache server is used to store the Time-to-Live (TTL) of a domain name and the address information corresponding to the domain name. The data processing device is used to obtain the network abnormality period of the DNS server, obtain the domain name query information within the network abnormality period, determine the whitelist domain names based on the domain name query information, read the TTL of the whitelist domain names from the cache server, and group the whitelist domain names in the cache server according to the TTL to obtain one or more groups corresponding to each whitelist domain name. When the TTL of the group meets the update condition, an update request is sent to the recursive server. The recursive server is used to receive the update request and send the latest address information of the whitelist domain names within the group to the data processing device; The data processing device is also used to send the latest parsed information to the cache server corresponding to the group for address information update.

Images